Bug 842512 (CVE-2013-4369) - VUL-1: CVE-2013-4369: XSA-68: xen: possible null dereference when parsing vif ratelimiting info
Summary: VUL-1: CVE-2013-4369: XSA-68: xen: possible null dereference when parsing vif...
Status: RESOLVED FIXED
Alias: CVE-2013-4369
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other Other
: P4 - Low : Normal
Target Milestone: ---
Assignee: Security Team bot
QA Contact: Security Team bot
URL:
Whiteboard: maint:running:54856:moderate maint:r...
Keywords:
Depends on:
Blocks:
 
Reported: 2013-09-26 11:28 UTC by Alexander Bergmann
Modified: 2015-02-19 03:33 UTC (History)
4 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Comment 2 Swamp Workflow Management 2013-09-26 22:00:22 UTC 
bugbot adjusting priority
Comment 3 Marcus Meissner 2013-10-10 13:10:58 UTC 
public now

             Xen Security Advisory CVE-2013-4369 / XSA-68
                               version 2

     possible null dereference when parsing vif ratelimiting info

UPDATES IN VERSION 2
====================

Public release.

ISSUE DESCRIPTION
=================

The libxlu library function xlu_vif_parse_rate does not properly
handle inputs which consist solely of the '@' character, leading to a
NULL pointer dereference.

IMPACT
======

A toolstack which allows untrusted users to specify an arbitrary
configuration for the VIF rate can be subjected to a DOS.

The only known user of this library is the xl toolstack which does not
have a central long running daemon and therefore the impact is limited
to crashing the process which is creating the domain, which exists
only to service a single domain.

VULNERABLE SYSTEMS
==================
The vulnerable code is present from Xen 4.2 onwards.

MITIGATION
==========

Disallowing untrusted users from specifying arbitrary VIF rate limits
will avoid this issue.

CREDITS
=======

This issue was discovered by Coverity Scan and Matthew Daley.

RESOLUTION
==========

Applying the attached patch resolves this issue in all branches

xsa68.patch        xen-unstable, Xen 4.3.x, Xen 4.2.x

$ sha256sum xsa68*.patch
64716cb49696298e0bbd9556fe9d6f559a4e2785081e28d50607317b6e27ba32  xsa68.patch
Comment 5 Marcus Meissner 2013-11-27 10:29:03 UTC 
released
Comment 6 Swamp Workflow Management 2013-11-27 13:03:52 UTC 
Update released for: xen, xen-debuginfo, xen-debugsource, xen-devel, xen-doc-html, xen-doc-pdf, xen-kmp-debug, xen-kmp-default, xen-kmp-pae, xen-kmp-trace, xen-kmp-vmi, xen-libs, xen-libs-32bit, xen-tools, xen-tools-domU
Products:
SLE-DEBUGINFO 11-SP3 (i386, x86_64)
SLE-DESKTOP 11-SP3 (i386, x86_64)
SLE-SDK 11-SP3 (i386, x86_64)
SLE-SERVER 11-SP3 (i386, x86_64)